CVE-2026-125752 Meteroid before 2.2.0 Cross-Tenant Authorization Bypass via UpdateCouponStatus
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125752?
CVE-2026-125752 is a low-severity vulnerability in meteroid-oss Meteroid, published on 10 Nov 2026.
Official description
Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whose UPDATE query filters only on coupon id and ignores tenant ID. Authenticated users with catalog:manage or a tenant-scoped API key can supply another tenant's coupon ID to disable, archive, or re-enable that coupon and receive its details.
Weakness: CWE-639
Which versions are affected by CVE-2026-125752?
How do I fix CVE-2026-125752?
No fix has been published for CVE-2026-125752 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125752 being exploited?
There is no known exploitation of CVE-2026-125752 in the wild and no public exploit code.
Sources
Also known as GHSA-hh33-9q27-w8qf.